Anthropic open-sources FlashProve, a zero-knowledge proof that a reply came from the model you were promised

Today, when you query a model you have no way to confirm which model actually answered. A routing service could quietly swap in a cheaper model, or an attacker could tamper with the token stream, and the output alone would not reveal it. Anthropic's Frontier Red Team, working with researchers from EPFL, StarkWare, MIT and Succinct, frames provable inference as the fix: the provider commits to a model and then proves that each response was produced by it[1].

FlashProve does this in two phases. Offline, the provider publishes a short commitment, a fingerprint that pins down one exact set of weights while keeping them hidden. Online, it produces a proof file for each reply showing that the committed model produced those output tokens. Anyone holding the commitment, prompt and reply can check it on an ordinary CPU in seconds[2].

Anthropic measured FlashProve on Llama 4 Maverick, a 400B-parameter mixture-of-experts model with about 17B parameters active per token, using public 4-bit weights. The one-time commitment takes about 39 minutes and is good for about 16 million requests. Proving a batch of 24 requests of 1,024 tokens takes about 223 seconds, or 110 tokens per second of prefill, and each proof is 18.78 MB. Proving runs after the fact over finished text in one parallel pass, so this is not a measure of how fast a reply is generated. Verifying needs no GPU: about 17 seconds on 24 CPU threads, or 21 seconds on one[1].

The cost is real. Compared with vLLM serving the same model on eight H100s, proving takes about 72 times longer per GPU, and about 94 times longer at the highest load Anthropic tried[1]. That is still a huge leap: the only earlier proof of the same model Anthropic knows of, VerInf, reported 14.3 hours for 1,000 tokens with a 93.6 GB proof that took almost a day to verify[1].

Part of the speed comes from design choices. The prover's work scales with the experts that actually ran rather than all 400B parameters, requests are proved in batches after the fact, and weights are streamed so a single 80 GB GPU with about 290 GB of host memory is enough[3].

Anthropic says Claude produced the zkSNARK improvements behind the system and wrote the protocol specification. Because Claude's optimizations can be hard to evaluate in a system this complex, the team stated the security guarantees in Lean, a formal verification language[1]. Soundness, completeness and zero knowledge are proved for the protocol, and a slower Lean verifier is proved to accept only valid claims. The fast C++ verifier and CUDA prover follow the same protocol and are tested against it, but are not themselves proved[4].

Anthropic ties the work to security and regulation: detecting a hijacked inference server, proving a model reviewed a codebase, and giving regulators a lightweight way to check that providers serve only approved models or that their hardware is genuinely running inference[1]. It is also a datapoint for the zero-knowledge machine learning field, where overhead of roughly two orders of magnitude is far lower than many expected.

The caveats are Anthropic's own. FlashProve proves an integer version of the model under greedy decoding, handles only 1,024-token contexts, assumes a mixture-of-experts architecture, does not hide the architecture and leaves side-channel attacks out of scope. Anthropic calls it intermediate progress and is releasing the code, Lean proofs and documentation under Apache 2.0 so others can build on it[1].